Russian hacker 'militia' mobilizes to attack Georgia
Volunteers, botnet owners join forces to knock sites offline, say researchers
Computerworld - Security researchers today disputed claims that a well-known Russian hacker-hosting network is responsible for cyberattacks against sites belonging to Georgia, the former Soviet republic that has been battling Russian military forces since Friday.
Rather than blame the notorious Russian Business Network -- as researcher Jart Armin did over the weekend -- other researchers said today that it appears that the attacks originated from a "hacker militia" of Russian botnet herders and volunteers.
"They mobilize themselves without a need for a central location to do so, distribute the targets, discuss the attack approaches, come up with a plan on the coordination, and you have everyone participating," Bulgarian security researcher Dancho Danchev said in an instant messaging interview early today.
Danchev and others have found evidence that points to a self-starting militia composed of volunteer hackers and cybercriminals who control large-scale bots, or collections of previously-compromised computers, as being behind the escalating attacks that have knocked Georgian sites offline.
"A lot of it started with posting on blogs," said Kimberly Zenz, a senior threat analyst at VeriSign Inc.'s iDefense Labs. "A bunch of youth groups posted something that was almost a manifesto that called on supporters to 'wage an information war' against Georgia."
That call to arms was only one of many, said Zenz and Danchev, both whom noted similarities to the attacks against several hundred Lithuanian Web sites early last month.
But while the forces assembled only appear to be uncoordinated to the untrained eye, they are in fact very coordinated, both researchers argued. In a lengthy blog post on ZDNet, Danchev spelled out the coordinated steps that someone -- or some group -- took to rally the hacker troops and turn them against specific targets.
"In the ongoing Russian vs. Georgia cyberwar, we have an indication of lists [of Georgian governmental sites] actively distributed across Russian Web forums," said Danchev in the blog entry. He also said there were signs that hackers had been provided simple distributed-denial-of-service (DDoS) tools, and that lists of Georgian sites vulnerable to SQL injection attacks had been circulating.
"Someone is coordinating activities," said Zenz, "by posting on blogs and forums instructions that essentially say, 'This is what we're going to do.' But we don't know who's behind that."
That coordination, said Danchev, was sophisticated enough to launch DDoS attacks against one of the most popular hacker forums in Georgia as a preemptive strike. But the attacks weren't entirely successful, since limited retaliations against Russian sites have succeeded. "Georgian hackers, or pro-Georgian hackers, [launched] distributed-denial-of-service [attacks against] RIA Novosti," he said via instant message. RIA Novosti is a Moscow-based news service.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Streamline Data Protection with IBM Tivoli Storage Manager Operations Center IBM Tivoli Storage Manager (TSM) has been an industry-standard data protection solution for two decades. But, where most competitors focus exclusively on Backup...
- Simplify and Consolidate Data Protection for Better Business Results Learn about IBM® Tivoli® Storage Manager Operations Center, which provides advanced visualization, built-in analytics and integrated workflow automation features that leapfrog traditional backup...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Cybercrime and Hacking White Papers | Webcasts